flux-opencode-plan

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled binary utility, fluxctl, located at .opencode/bin/fluxctl. This tool is used to initialize the planning environment, manage epics, and create task specifications within the .flux/ directory.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands such as git rev-parse, jq, and cat to perform repository introspection and version checking during the setup phase.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of external data during the planning phase.
  • Ingestion points: User-provided requirements in $ARGUMENTS and external repository content retrieved by the github-scout and docs-scout subagents.
  • Boundary markers: The skill uses heredocs (<<'EOF') to separate plan content from command-line arguments when calling fluxctl, which mitigates shell injection but lacks explicit LLM context delimiters for researched data.
  • Capability inventory: The agent has the capability to write to the local filesystem via fluxctl, execute shell commands, and invoke further subagents through the task tool.
  • Sanitization: Input for task specifications is passed via stdin or temporary files to the fluxctl binary, preventing direct shell interpolation of potentially malicious payloads.
  • [EXTERNAL_DOWNLOADS]: The github-scout component utilizes the gh CLI to search for code across external repositories to facilitate context gathering, which is a standard functional behavior for this tool class.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 05:20 AM